{"id":"CVE-2026-114597","kind":"vulnerability","aliases":["CVE-2026-114597"],"related":[],"title":"EPICS Base: network message validation flaw reads past buffer bounds","description":"In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.","summary":"EPICS Base release 7.0.10 and earlier does not properly validate element or length values in a network message, so the application can read beyond an allocated buffer. An attacker can crash the process (denial of service) and may read adjacent memory contents.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["epics","industrial-control","infrastructure","scada","self-hosted"],"not_affected_if":["isolated-network"],"how_to_check":"- Check the installed EPICS Base version (for example with `caget` or the build's release file) and see whether it is `7.0.10` or earlier\n- unknown","fix":"- Move EPICS Base to a release newer than `7.0.10`\n- unknown","status":"open","published_at":"2026-10-27T17:16:58+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","triaged_at":"2026-10-27T17:34:25+00:00","updated_at":"2026-10-27T17:34:25+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T17:34:25Z","model":"claude-haiku-5-5","output":{"fix":"- Move EPICS Base to a release newer than `7.0.10`\n- unknown","reach":"network","title":"EPICS Base: network message validation flaw reads past buffer bounds","impact":"medium","summary":"EPICS Base release 7.0.10 and earlier does not properly validate element or length values in a network message, so the application can read beyond an allocated buffer. An attacker can crash the process (denial of service) and may read adjacent memory contents.","category":"infrastructure","nicknames":[],"who_cares":["epics","scada","industrial-control","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Process crashes and adjacent memory contents may be exposed","analyst_note":"Check the NVD entry and the EPICS Base release notes for the fixed version and the affected network component.","how_to_check":"- Check the installed EPICS Base version (for example with `caget` or the build's release file) and see whether it is `7.0.10` or earlier\n- unknown","needs_analyst":true,"not_affected_if":["isolated-network"],"who_is_affected":"Teams that run EPICS Base 7.0.10 or earlier with IOCs or gateways reachable over the network, since the flawed code parses incoming network messages. Systems not running EPICS Base, or running it only on isolated hosts with no network exposure, are less likely to be affected. The sources do not say which EPICS components or protocol paths are vulnerable.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000596,"input_tokens":3295,"output_tokens":532,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114597':13A,16A '-2026':12A,15A '7.0.10':29B,72C 'adjac':65B,110C 'alloc':51B,98C 'applic':46B,90C 'attack':54B 'base':2A,27B,70C 'beyond':49B,93C 'bound':10A,95C 'buffer':9A,52B,99C 'caus':88C 'content':67B,112C 'control':20B 'could':108C 'crash':56B 'cve':11A,14A 'denial':59B,104C 'earlier':31B 'element':36B,79C 'epic':1A,17B,26B,69C 'expos':109C 'flaw':6A 'host':25B 'industri':19B 'industrial-control':18B 'infrastructur':21B 'insuffici':76C 'lead':102C 'length':38B,81C 'may':63B,101C 'memori':66B,111C 'messag':4A,43B,86C 'network':3A,42B,85C 'past':8A 'prior':74C 'process':58B 'proper':34B 'read':7A,48B,64B,92C 'releas':28B,71C 'scada':22B 'self':24B 'self-host':23B 'servic':61B,106C 'valid':5A,35B,77C 'valu':39B,82C","nicknames":[],"mitigations":[],"who_affected":"Teams that run EPICS Base 7.0.10 or earlier with IOCs or gateways reachable over the network, since the flawed code parses incoming network messages. Systems not running EPICS Base, or running it only on isolated hosts with no network exposure, are less likely to be affected. The sources do not say which EPICS components or protocol paths are vulnerable.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114597","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114597","severity":null,"published_at":"2026-10-27T17:16:58+00:00","modified_at":"2026-10-27T17:16:58+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","fetched_at":"2026-10-27T17:32:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}